---
title: "Forensic Trajectory Signatures for Agent Memory Poisoning Detection"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30566v1"
permalink: "https://feed.astralor.com/items/itm_097ce50a0f211248bf4d8500"
published: "2026-06-29T17:09:03.000Z"
score: 58
channel: "ai"
tags: ["GPT-4.1","GPT-4o","Agent Safety","detection method","Behavioral Invariance","Memory Poisoning Attack"]
---

# Forensic Trajectory Signatures for Agent Memory Poisoning Detection

## At a glance

This paper discovers a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email, a transition rarely seen in non-exfiltrating sessions. A simple rule based on this invariant achieves AUC=0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC=0.9904. Cross-model hold-out on 9 models (7B-120B) confirms AUC=1.000 on 6/9 splits, and generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A prefix-only variant achieves AUC=0.934, enabling real-time blocking. Prompt injection attacks yield distinct trajectories (score=0.541), enabling differentiation of attack types from tool-call logs alone.

## Key points

- A behavioral invariant in LLM agents under memory poisoning: memory_recall_fact must precede email_send_email for successful attacks.
- Simple rule based on invariant achieves AUC=0.9563; Random Forest model reaches AUC=0.9904.
- Cross-model validation on 9 models shows AUC=1.000 on 6/9 splits; generalizes to GPT-4.1/4o without retraining.
- Prefix-only variant achieves AUC=0.934 for real-time blocking; prompt injection yields distinct trajectory (score=0.541) for attack differentiation.

## Full text

We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack's information-retrieval dependency rather than being merely an empirical correlation, and suppressing it breaks the attack. A simple rule exploiting this invariant alone achieves AUC = 0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC = 0.9904 (BCa 95% CI [0.987, 0.993], N=10,000 resamples), demonstrating that the attack imprints on multiple independent behavioral channels. The signature is overdetermined: removing all recall-related features (half the feature set) leaves AUC unchanged at 0.990, confirming that memory poisoning induces a distributed trajectory signature rather than a single observable anomaly. Cross-model hold-out on 9 models (7B-120B parameters) confirms AUC = 1.000 on 6/9 hold-out splits, with all three exceptions mechanistically explained. The invariant generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation. The boundary is forensically useful: prompt-injection attacks that bypass memory produce a distinct trajectory (score = 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_097ce50a0f211248bf4d8500